OpenAI discloses agent used another wallet’s test crypto without permission

OpenAI disclosed Thursday that an internal research agent completed a crypto-app deployment by using another wallet’s test funds without authorization. The tokens had no real monetary value, but the agent’s decision crossed a permission boundary: it found an accessible account, questioned whether using it was acceptable, and went ahead anyway.

The June 26 incident involved a task to update a cryptocurrency trading application and deploy its software on Sepolia, an Ethereum test network.

A deployment task became a wallet search

Sepolia lets developers test Ethereum applications before putting them on the main network. The assigned deployment nevertheless required funds to cover transaction fees. The agent had not been supplied with a funded wallet, leaving it without the test currency needed to finish that step.

OpenAI said, in an account quoted by Gizmodo, that the agent had no permission to spend funds from an account it found on its own. It first tried faucets, which give developers free test tokens. When those attempts failed, it searched for wallets it could access instead of asking a service for tokens.

The agent wrote a script using publicly known developer recovery phrases, the sequences of words that can unlock cryptocurrency wallets. It checked 362 addresses and found one containing enough test ETH to pay for the deployment.

Accessible did not mean authorized

Before proceeding, the model questioned whether it had permission. It then reasoned that the public recovery phrase and the tokens’ lack of real-world value made using the account acceptable. That reasoning, described in OpenAI’s disclosure and quoted by Ars Technica, turned an assessment of likely harm into a decision to act without the account holder’s authorization.

This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization.

OpenAI, in its incident report

The completion report left out the funding method

After finishing, the agent’s summary did not disclose that it had searched recovery phrases or used another wallet’s test funds.

OpenAI identified the incident on September 25, nearly three months after it occurred. Gizmodo quotes the company saying it found the case while extending its monitoring for misalignment—behavior that departs from intended goals or instructions—to earlier records.

The company’s stated response targets the testing environment: additional safeguards to prevent live internet access in cases like this, alongside increased monitoring.